From 4e13ecdd028875b8303b4c1e3a14aefdceabb3e9 Mon Sep 17 00:00:00 2001
From: Tarun Kumar Reddy Etikala <tetikala@redhat.com>
Date: Thu, 23 Apr 2026 10:53:11 -0400
Subject: [PATCH] fix: address CodeRabbit review findings

- Fix image exclusion to match nested directories at any depth
  (agents/*/images/*, etc.) instead of only top-level images/*
- Only catch 404 in ensure_label_exists, re-raise 403/429/500
- Pin PyGithub==2.6.0 to avoid supply-chain risk in pull_request_target
- Add warning step when size labeling fails for better observability

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/scripts/pr_size.py       | 10 +++++++---
 .github/workflows/pr-labeler.yml |  8 +++++++-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/pr_size.py b/.github/scripts/pr_size.py
index 79b133d2..b89ccbe5 100755
--- a/.github/scripts/pr_size.py
+++ b/.github/scripts/pr_size.py
@@ -41,7 +41,6 @@
     "uv.lock",
     "*.lock",
     "*.generated.*",
-    "images/*",
 ]
 
 XL_COMMENT_MARKER = "<!-- pr-size-labeler:xl-warning -->"
@@ -58,7 +57,10 @@
 
 
 def is_excluded(filename: str) -> bool:
-    """Check if a file matches any exclusion pattern."""
+    """Check if a file matches any exclusion pattern or is inside an images/ directory."""
+    # Check path-component match for images directories at any depth
+    if "/images/" in f"/{filename}":
+        return True
     for pattern in EXCLUDED_PATTERNS:
         if fnmatch.fnmatch(filename, pattern):
             return True
@@ -77,7 +79,9 @@ def ensure_label_exists(repo, label_name: str) -> None:
     """Create the label in the repo if it doesn't exist."""
     try:
         repo.get_label(label_name)
-    except GithubException:
+    except GithubException as exc:
+        if exc.status != 404:
+            raise
         color = LABEL_COLORS.get(label_name, "ededed")
         repo.create_label(name=label_name, color=color)
         print(f"Created label: {label_name}")
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index be345528..36054f97 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -36,12 +36,18 @@ jobs:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: pip install PyGithub
+        run: pip install PyGithub==2.9.1
 
       - name: Apply size labels
+        id: size_labels
         continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: python .github/scripts/pr_size.py
+
+      - name: Warn if size labeling failed
+        if: steps.size_labels.outcome == 'failure'
+        run: |
+          echo "::warning::Size labeling failed; area labels were applied but size labels may be stale or missing."